General

  • Target

    5a3959b9da3a18ca08896cee8c7f04c1_JaffaCakes118

  • Size

    45KB

  • Sample

    240719-dlfszstakh

  • MD5

    5a3959b9da3a18ca08896cee8c7f04c1

  • SHA1

    7f49a364b3f8383374fe95cc63e7d26a3004571a

  • SHA256

    37dfe9c15f6036e198aedbada51b8866e8fdaba7c6a4f7b750df196fc806aa87

  • SHA512

    a935001682762f28be76899e2d295a7575df447e475fd4cc7abfc36872b24770207d5cc9861f8338db9add4bd9cbad01d6f8ebfe221716fe58f9938285ec6de8

  • SSDEEP

    768:LBr+tjFqTPkAlfztB1lr6an3smTA8uvm2DfOTwYPIhKzoLEb:lyRUHlrL1lr6an3TLuvm2buQhmo4b

Malware Config

Extracted

Family

xtremerat

C2

sniper-sa.no-ip.org

Targets

    • Target

      5a3959b9da3a18ca08896cee8c7f04c1_JaffaCakes118

    • Size

      45KB

    • MD5

      5a3959b9da3a18ca08896cee8c7f04c1

    • SHA1

      7f49a364b3f8383374fe95cc63e7d26a3004571a

    • SHA256

      37dfe9c15f6036e198aedbada51b8866e8fdaba7c6a4f7b750df196fc806aa87

    • SHA512

      a935001682762f28be76899e2d295a7575df447e475fd4cc7abfc36872b24770207d5cc9861f8338db9add4bd9cbad01d6f8ebfe221716fe58f9938285ec6de8

    • SSDEEP

      768:LBr+tjFqTPkAlfztB1lr6an3smTA8uvm2DfOTwYPIhKzoLEb:lyRUHlrL1lr6an3TLuvm2buQhmo4b

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks